This vulnerability exists in the IdP mapper component of Red Hat Build of Keycloak, where an administrator with restricted permissions can exploit the ability to create a "Hardcoded Role" mapper. This mapper can assign powerful roles such as realm-admin, effectively elevating privileges beyond intended limits. The flaw enables privilege escalation within the realm by bypassing security checks. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact with no availability impact. Red Hat has published an advisory but has not yet provided a patch or official remediation instructions.

An attacker with limited administrative permissions can escalate their privileges to full realm administrator by exploiting this flaw. This results in complete control over the realm, including the ability to manage users, roles, and configurations, potentially compromising confidentiality and integrity of the system. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-12388 for current remediation guidance. Until a fix is available, restrict administrative permissions carefully to trusted users and monitor for unauthorized creation of "Hardcoded Role" mappers. No official fix or temporary workaround is currently documented by Red Hat.